Linux Kernel CVE-2026-72449

Upgrade to a patched stable kernel version: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc1. Commits are available via https://git.kernel.org/stable/c/ at the references listed in this CVE. Distributions (Debian, Ubuntu, RHEL, SUSE, etc.) will ship these as kernel security updates; check your distribution's security advisories for packaged versions. If immediate patching is not feasible, the following compensating controls can reduce exposure: restrict /dev/kfd permissions so that only trusted users or service accounts belong to the render group (e.g., remove non-essential users from the render group with gpasswd -d <user> render), which eliminates the attack surface for untrusted local users. Alternatively, if AMD GPU CRIU checkpoint/restore functionality is not required, consider blocking AMDKFD_IOC_CRIU_OP via a seccomp policy or BPF LSM rule targeting the ioctl command code - this prevents the vulnerable code path from being reached without disabling the broader amdkfd driver. Note that restricting render group membership may impact GPU-accelerated workloads for affected users. No confidentiality workaround exists for systems where render group access is legitimately granted to untrusted users; patching is the only complete fix.